feat(providers): run Factory Droid as a native provider

.coderabbit.config.ts

@@ -1,15 +1,14 @@
 import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
 
-// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
-// requests changes until its comments are resolved, then approves.
+// Org members and collaborators can approve their own pull requests.
 const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
 
 export default defineConfig((ctx) => ({
   reviews: {
     high_level_summary: false,
     review_status: false,
-    request_changes_workflow: isGated(ctx),
+    request_changes_workflow: false,
     allow_author_approval: !isGated(ctx),
     auto_review: {
       enabled: true,

.github/workflows/cursor-hygiene-webhook.yml

@@ -28,9 +28,23 @@ jobs:
             echo "Missing CURSOR_T3CODE_WEBHOOK_URL or CURSOR_T3CODE_WEBHOOK_AUTH — skipping."
             exit 0
           fi
-          curl -fsS --max-time 60 -X POST "$URL" \
-            -H "Authorization: $AUTH" \
-            -H "Content-Type: application/json" \
-            -H "X-GitHub-Event: ${{ github.event_name }}" \
-            -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
-            --data-binary @"${{ github.event_path }}"
+          for attempt in 1 2 3; do
+            curl_status=0
+            http_status=$(curl -fsS --max-time 60 -X POST "$URL" \
+              --output /dev/null --write-out '%{http_code}' \
+              -H "Authorization: $AUTH" \
+              -H "Content-Type: application/json" \
+              -H "X-GitHub-Event: ${{ github.event_name }}" \
+              -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
+              --data-binary @"${{ github.event_path }}") || curl_status=$?
+            if [ "$curl_status" -eq 0 ]; then
+              exit 0
+            fi
+            if [ "$GITHUB_REF" != "refs/heads/main" ] || \
+               [ "$curl_status" -ne 22 ] || [ "$http_status" != "400" ] || \
+               [ "$attempt" -eq 3 ]; then
+              exit "$curl_status"
+            fi
+            echo "Cursor webhook returned HTTP 400; retrying in 5 seconds ($attempt/2)."
+            sleep 5
+          done

.github/workflows/mobile-eas-production.yml

@@ -7,10 +7,11 @@ name: Mobile EAS Production
 # runner, with corepack pinning pnpm 10.24 in eas.json, local == build.
 #
 # Every merge to main that touches the mobile app reconciles, per platform:
-#   1. Store builds: if the latest production build's version differs from
-#      app.config.ts, cut a new build and submit it (TestFlight + Play internal
-#      track). Bumping `version` is therefore all it takes to
-#      start the next release train — the first build of a version enters
+#   1. Store builds: when no production build matches the current native
+#      fingerprint, or the latest build's version differs from app.config.ts,
+#      cut a new build and submit it (TestFlight + Play internal track). Native
+#      changes therefore ship a binary on merge, and bumping `version` is all
+#      it takes to start the next release train — the first build of a version enters
 #      external-TestFlight beta review immediately, and later builds of the
 #      same version auto-approve until that version is released. After App
 #      Store approval, Apple closes the release train and `version` must be
@@ -21,10 +22,11 @@ name: Mobile EAS Production
 #      fingerprint. Older binaries of the same major version with a matching
 #      fingerprint receive it too; the major version is part of the
 #      fingerprint (apps/mobile/fingerprint.config.js), so a new major never
-#      reaches the previous major's store binaries over the air. When native
-#      drift means no binary could install the update,
-#      it is skipped and flagged in the job summary instead of published
-#      into the void.
+#      reaches the previous major's store binaries over the air. Until a
+#      build for the new fingerprint finishes, the OTA is skipped rather than
+#      published into the void.
+# Hold native-change PRs (the "📱 Native Change" label) and merge them as a
+# batch to avoid a store build per PR.
 # workflow_dispatch remains as a manual override for both modes (e.g. to
 # retry an errored build or force an OTA).
 # Manual v2-preview builds keep the production app identity and disable OTA.
@@ -263,61 +265,74 @@ jobs:
             --message "${{ inputs.message || format('Production OTA ({0})', github.sha) }}" \
             --non-interactive
 
-      # No --status filter on build:list: an in-queue/in-progress build must
-      # count as existing, or every merge during the build window would cut a
-      # duplicate. After an errored build, retry via workflow_dispatch
-      # mode=build — pushes won't re-trigger it until the app version changes.
-      - id: store_builds
-        name: Ensure store builds exist for the current app version
+      # One pass per platform. The fingerprint decides OTA vs store build:
+      #   - a finished build matches → publish the OTA;
+      #   - a queued/in-progress build matches → wait, the next merge after it
+      #     finishes publishes the OTA (no duplicate build per merge);
+      #   - no build matches → native drift, so cut and submit a new build.
+      # A version bump also cuts a build even when native code is unchanged,
+      # because only the major version is part of the fingerprint.
+      # An errored build for this fingerprint is not retried on push (it would
+      # rebuild on every merge); retry via workflow_dispatch mode=build.
+      - id: reconcile
+        name: Publish OTA or cut store build
         if: steps.expo-token.outputs.present == 'true' && github.event_name == 'push'
-        continue-on-error: true
         working-directory: apps/mobile
         env:
           EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
         run: |
           failed=0
           version="$(npx expo config --json --type public | jq -r '.version')"
-          for platform in ios android; do
-            latest="$(eas build:list --platform "$platform" --build-profile production --limit 1 --json --non-interactive | jq -r '.[0].appVersion // "none"')"
-            if [ "$latest" = "$version" ]; then
-              echo "$platform: production build for $version already exists (or is in progress)"
-              continue
-            fi
-            echo "$platform: latest production build is $latest, app.config.ts says $version — building"
-            if eas build --platform "$platform" --profile production --auto-submit --non-interactive --no-wait; then
-              echo ":building_construction: $platform: scheduled production build and submission for $version" >> "$GITHUB_STEP_SUMMARY"
-            else
-              failed=1
-              echo ":x: $platform: production build or submission failed for $version" >> "$GITHUB_STEP_SUMMARY"
-            fi
-          done
-          exit "$failed"
-
-      - name: Publish fingerprint-gated OTA
-        if: steps.expo-token.outputs.present == 'true' && github.event_name == 'push'
-        working-directory: apps/mobile
-        env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-        run: |
           message="$(git log -1 --pretty=%s | head -c 120) ($(git rev-parse --short=9 HEAD))"
           for platform in ios android; do
             # eas-cli prints an environment-loaded notice to stdout before the
             # JSON even with --json, so discard everything before the document.
             hash="$(eas fingerprint:generate --platform "$platform" --environment production --json --non-interactive | sed -n '/^{/,$p' | jq -er '.hash | select(type == "string" and length > 0)')"
-            matching="$(eas build:list --platform "$platform" --build-profile production --status finished --fingerprint-hash "$hash" --limit 1 --json --non-interactive | jq 'length')"
-            if [ "$matching" -gt 0 ]; then
-              eas update \
+            matches="$(eas build:list --platform "$platform" --build-profile production --fingerprint-hash "$hash" --limit 20 --json --non-interactive)"
+            finished="$(jq '[.[] | select(.status == "FINISHED")] | length' <<<"$matches")"
+            active="$(jq '[.[] | select(.status == "NEW" or .status == "IN_QUEUE" or .status == "IN_PROGRESS")] | length' <<<"$matches")"
+            errored="$(jq '[.[] | select(.status == "ERRORED")] | length' <<<"$matches")"
+            latest_version="$(eas build:list --platform "$platform" --build-profile production --limit 1 --json --non-interactive | jq -r '.[0].appVersion // "none"')"
+
+            if [ "$finished" -gt 0 ]; then
+              if eas update \
                 --channel production \
                 --environment production \
                 --platform "$platform" \
                 --message "$message" \
-                --non-interactive
-              echo ":white_check_mark: $platform: OTA published to production (fingerprint \`$hash\`)" >> "$GITHUB_STEP_SUMMARY"
+                --non-interactive; then
+                echo ":white_check_mark: $platform: OTA published to production (fingerprint \`$hash\`)" >> "$GITHUB_STEP_SUMMARY"
+              else
+                failed=1
+                echo ":x: $platform: OTA publish failed (fingerprint \`$hash\`)" >> "$GITHUB_STEP_SUMMARY"
+              fi
+            fi
+
+            reason=""
+            if [ "$finished" -eq 0 ] && [ "$active" -eq 0 ]; then
+              if [ "$errored" -gt 0 ]; then
+                echo ":x: $platform: the production build for fingerprint \`$hash\` errored — retry with workflow_dispatch mode=build" >> "$GITHUB_STEP_SUMMARY"
+                failed=1
+                continue
+              fi
+              reason="native fingerprint \`$hash\` has no build"
+            elif [ "$latest_version" != "$version" ] && [ "$active" -eq 0 ]; then
+              reason="latest production build is $latest_version, app.config.ts says $version"
+            fi
+
+            if [ -z "$reason" ]; then
+              if [ "$finished" -eq 0 ]; then
+                echo ":hourglass: $platform: production build for fingerprint \`$hash\` is in progress — OTA resumes on the next merge after it finishes" >> "$GITHUB_STEP_SUMMARY"
+              fi
+              continue
+            fi
+
+            echo "$platform: $reason — building"
+            if eas build --platform "$platform" --profile production --auto-submit --non-interactive --no-wait; then
+              echo ":building_construction: $platform: scheduled production build and submission for $version ($reason)" >> "$GITHUB_STEP_SUMMARY"
             else
-              echo ":warning: $platform: no finished production build matches fingerprint \`$hash\` — OTA skipped; JS changes reach $platform only once a matching build ships" >> "$GITHUB_STEP_SUMMARY"
+              failed=1
+              echo ":x: $platform: production build or submission failed for $version" >> "$GITHUB_STEP_SUMMARY"
             fi
           done
-
-      - name: Propagate store build failure
-        if: steps.store_builds.outcome == 'failure'
-        run: exit 1
+          exit "$failed"

.github/workflows/release-desktop.yml

@@ -129,6 +129,39 @@ jobs:
           git sparse-checkout set --no-cone '/*' '!/.repos/'
           git -c checkout.workers=0 checkout --detach FETCH_HEAD
 
+      # The runner's PowerShell 7.6/.NET 10 intermittently crashes during signing:
+      # https://github.com/dotnet/runtime/issues/131636
+      # Put the .NET 8 release first for both workflow shells and electron-builder.
+      - name: Use PowerShell 7.4 for Windows ARM builds
+        if: inputs.platform == 'win' && inputs.arch == 'arm64'
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          $ProgressPreference = "SilentlyContinue"
+          $version = "7.4.20"
+          $archive = Join-Path $env:RUNNER_TEMP "PowerShell-$version-win-arm64.zip"
+          $installDir = Join-Path $env:RUNNER_TEMP "powershell-$version-arm64"
+          Invoke-WebRequest -UseBasicParsing `
+            -Uri "https://github.com/PowerShell/PowerShell/releases/download/v$version/PowerShell-$version-win-arm64.zip" `
+            -OutFile $archive
+          $expectedHash = "67eff749d5dae357501c95a3eec1dcd93f669824e3ca2b1d2adcdecdebf04f35"
+          if ((Get-FileHash $archive -Algorithm SHA256).Hash -ne $expectedHash) {
+            throw "PowerShell archive checksum mismatch"
+          }
+          Expand-Archive -Path $archive -DestinationPath $installDir
+          $installDir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          & "$installDir\pwsh.exe" -NoProfile -NonInteractive -Command '$PSVersionTable; [System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture'
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Verify Windows ARM PowerShell selection
+        if: inputs.platform == 'win' && inputs.arch == 'arm64'
+        shell: pwsh
+        run: |
+          $expectedPath = Join-Path $env:RUNNER_TEMP "powershell-7.4.20-arm64\pwsh.exe"
+          if ((Get-Command pwsh.exe).Source -ne $expectedPath -or $PSVersionTable.PSVersion -ne [version]"7.4.20") {
+            throw "Windows ARM builds must use the pinned PowerShell runtime"
+          }
+
       # Windows installs straight from the registry. There, linking the packages
       # takes the time, not downloading them, so a ~700 MB package cache did not
       # pay for its own restore. Across recent nightlies, restore plus install

README.md

@@ -2,7 +2,7 @@
 
 T3 Code is an "agent harness control surface". It enables control of the agents on your machine with a best-in-class mobile app ([iOS](https://apps.apple.com/us/app/t3-code-remote-claude-more/id6787819824), [Android](https://play.google.com/store/apps/details?id=com.t3tools.t3code)), [web app](https://app.t3.codes) and [Electron-based desktop app](https://t3.codes).
 
-Works with your subscriptions on Claude Code, Codex, Cursor, Grok Build, OpenCode, and Google Antigravity. If they're set up on your computer, T3 Code can control them.
+Works with your subscriptions on Claude Code, Codex, Cursor, Grok Build, OpenCode, Google Antigravity, and Factory Droid. If they're set up on your computer, T3 Code can control them.
 
 ## "Wait, what are you selling me?"
 
@@ -13,14 +13,15 @@ We wanted something performant, remote-ready, and truly open. If we ever go the
 ## Installation
 
 > [!WARNING]
-> T3 Code currently supports Codex, Claude, Cursor, Grok Build, OpenCode, and Antigravity. Install and authenticate at least one provider before use:
+> T3 Code currently supports Codex, Claude, Cursor, Grok Build, OpenCode, Antigravity, and Factory Droid. Install and authenticate at least one provider before use:
 >
 > - Codex: install [Codex CLI](https://developers.openai.com/codex/cli) and run `codex login`
 > - Claude: install [Claude Code](https://claude.com/product/claude-code) and run `claude auth login`
 > - Cursor: install [Cursor CLI](https://cursor.com/cli) and run `agent login`
 > - Grok Build: install [Grok Build CLI](https://x.ai/cli) and run `grok login`
 > - OpenCode: install [OpenCode](https://opencode.ai) and run `opencode auth login`
 > - Antigravity: enable it in Settings, then use **Install Antigravity** and **Sign in with Google**. No CLI is required.
+> - Factory Droid: install with `curl -fsSL https://app.factory.ai/cli | sh`, then sign in on the server.
 
 ### Command line
 

apps/desktop/scripts/electron-launcher.mjs

@@ -20,7 +20,7 @@ const APP_BUNDLE_ID = isDevelopment
   ? `com.t3tools.t3code.dev.${devBundleIdSuffix || "local"}`
   : "com.t3tools.t3code";
 const APP_PROTOCOL_SCHEMES = isDevelopment ? ["t3code-dev"] : ["t3code"];
-const LAUNCHER_VERSION = 19;
+const LAUNCHER_VERSION = 20;
 const developmentMacIconPngPath = NodePath.join(
   repoRoot,
   "assets",
@@ -280,6 +280,8 @@ function patchMainBundleInfoPlist(appBundlePath, iconPath, executableName) {
   for (const [key, value] of Object.entries(resolveMacBundleInfoPlistStrings(executableName))) {
     setPlistString(infoPlistPath, key, value);
   }
+  // macOS 26 offers Messages/Mail codes in every text field unless opted out.
+  setPlistJson(infoPlistPath, "NSAutoFillRequiresTextContentTypeForOneTimeCodeOnMac", true);
   setPlistJson(infoPlistPath, "CFBundleURLTypes", [
     {
       CFBundleURLName: APP_BUNDLE_ID,

apps/desktop/src/app/DesktopClerk.test.ts

@@ -396,7 +396,7 @@ it.effect.each(["startup", "open-url"] as const)(
     }).pipe(Effect.scoped),
 );
 
-it.effect("hands a web link to the renderer and leaves other links alone", () =>
+it.effect("hands web and app links to the renderer and leaves other links alone", () =>
   Effect.gen(function* () {
     storageMock.mockReturnValue(storageAdapter);
     createClerkBridgeMock.mockReturnValue({ cleanup: vi.fn(), isPrimaryInstance: true });
@@ -420,10 +420,19 @@ it.effect("hands a web link to the renderer and leaves other links alone", () =>
       // macOS hands the default browser every web link.
       assert.strictEqual(open("https://example.com/page"), 1);
       assert.strictEqual(open("http://localhost:3000/"), 1);
+      // Prompt and thread links ride the same queue; the renderer routes them in the app.
+      assert.strictEqual(open("t3code://new?prompt=hi"), 1);
+      assert.strictEqual(open("t3code://threads/env-1/thread-1"), 1);
       // Anything else is not a web page; Electron keeps its own handling.
       assert.strictEqual(open("mailto:hello@example.com"), 0);
+      assert.strictEqual(open("t3code://somewhere-else"), 0);
       yield* Effect.yieldNow;
-      assert.deepStrictEqual(received, ["https://example.com/page", "http://localhost:3000/"]);
+      assert.deepStrictEqual(received, [
+        "https://example.com/page",
+        "http://localhost:3000/",
+        "t3code://new?prompt=hi",
+        "t3code://threads/env-1/thread-1",
+      ]);
     }).pipe(
       Effect.provide(layerDesktopClerk(true, [], "darwin")),
       Effect.provideService(HostProcess.Arguments, ["t3"]),